OPS-LOG-001A add ingestion diagnostics boundaries

[ktalpay]

Motivation

• Centralize and standardize redaction logic so all runtime diagnostics pass through a single safe boundary instead of duplicated helpers.
• Provide a lightweight, machine-readable ingestion run summary boundary so orchestration can emit sanitized structured output for downstream consumers.
• Preserve existing human-readable stdout behavior while adding an opt-in JSON summary output for run-ingestion and ensure failures are sanitized.

Description

• Added a new diagnostics package with src/carbonfactor_parser/diagnostics/redaction.py exposing redact_sensitive_text and src/carbonfactor_parser/diagnostics/ingestion_runtime_events.py exposing build_configured_cycle_summary_payload and build_configured_runner_summary_payload to build sanitized JSON-ready summaries.
• Wired an optional CLI flag --summary-output <path> to carbonops-parser run-ingestion and implemented _write_ingestion_summary_output to write sanitized JSON summaries; the default text stdout behavior is unchanged when the option is omitted.
• Replaced/delegated the local _redact_sensitive_text helpers in configured_cycle_runner, production_e2e_year_orchestrator, and postgresql_source_family_repository to the centralized redact_sensitive_text to ensure consistent sanitization of emitted messages.
• Added focused tests: tests/test_diagnostics_runtime_output.py for redaction and payload contents, tests/test_run_ingestion_summary_cli.py for CLI summary writing and default behavior, and updates to tests/test_postgresql_source_family_repository.py to validate repository error redaction.

Testing

• Ran focused tests with python -m pytest tests/test_diagnostics_runtime_output.py tests/test_run_ingestion_summary_cli.py tests/test_postgresql_source_family_repository.py tests/test_configured_cycle_runner.py, which passed (27 passed, 1 skipped).
• Ran full test suite with python -m pytest, which passed (2101 passed, 8 skipped).
• Performed git diff --check and ensured no generated artifacts were added and the change preserves existing CLI exit behavior when --summary-output is omitted.

---

Codex Task

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8dd7902dd8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Redact suffixed token and key assignments

When runtime diagnostics contain common credential names such as api_key=... or access_token=..., this new boundary leaves the values intact because both the query-key set and assignment regex only match exact key/token words. The helpers this replaces in the ingestion runner redacted those cases by matching key=/token= within the assignment name, and other diagnostics in this repo already classify api_key/access-key variants as sensitive, so these secrets can now be written to stdout or --summary-output unredacted. Please include the known suffixed key/token forms before emitting sanitized diagnostics.

Useful? React with 👍 / 👎.